dab5146f6c7ebe3d04c4d903922c7202ce1af89f126386e317c7de88c8532c92

Interactive malware hunting service

General Info

File name: BOT.exe

Full analysis: https://app.any.run/tasks/293a72b2-818e-4573-8910-c4309a1727ab

Verdict: Malicious activity

Analysis date: 7/11/2019, 18:16:37

OS:: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)

Indicators:

MIME:: application/x-dosexec

File info:: PE32 executable (GUI) Intel 80386, for MS Windows

MD5: 9df57545af2241c1101624161b245ac5

SHA1: 50dabcdf509ed7130da0c1d91082c41af282efde

SHA256: dab5146f6c7ebe3d04c4d903922c7202ce1af89f126386e317c7de88c8532c92

SSDEEP: 196608:9zq+29L+NJ6ZQLJG4otpRDXAU9lKeHb3dlhr1ksBFyeSMeM/DckywX:NpToTtpRDQU/LHb33CjVMQpS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration: 60 seconds

Additional time used: none

Fakenet option: off

Heavy Evaision option: off

MITM proxy: off

Route via Tor: off

Network geolocation: off

Privacy: Public submission

Autoconfirmation of UAC: on

Software preset

Internet Explorer 8.0.7601.17514
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (75.0.3770.100)
Google Update Helper (1.3.34.7)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.7.2 (4.7.03062)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
Mozilla Firefox 67.0.4 (x86 en-US) (67.0.4)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB4019990
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Behavior activities

MALICIOUS	SUSPICIOUS	INFO
Loads dropped or rewritten executable BOT.exe (PID: 3596)	Reads Internet Cache Settings BOT.exe (PID: 3596) Executable content was dropped or overwritten BOT.exe (PID: 3596)	No info indicators.

MALICIOUS

SUSPICIOUS

INFO

Loads dropped or rewritten executable

BOT.exe (PID: 3596)

Reads Internet Cache Settings

BOT.exe (PID: 3596)

Executable content was dropped or overwritten

BOT.exe (PID: 3596)

No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD

.dll

| Win32 Dynamic Link Library (generic) (43.5%)

.exe

| Win32 Executable (generic) (29.8%)

.exe

| Generic Win/DOS Executable (13.2%)

.exe

| DOS Executable Generic (13.2%)

EXIF

MachineType:

Intel 386 or later, and compatibles

TimeStamp:

2019:07:10 11:34:43+02:00

PEType:

PE32

LinkerVersion:

CodeSize:

1444352

InitializedDataSize:

1150976

UninitializedDataSize:

null

EntryPoint:

0x6792b9

OSVersion:

ImageVersion:

null

SubsystemVersion:

Subsystem:

Windows GUI

Summary

Architecture:

IMAGE_FILE_MACHINE_I386

Subsystem:

IMAGE_SUBSYSTEM_WINDOWS_GUI

Compilation Date:

10-Jul-2019 09:34:43

Detected languages

Chinese - PRC

DOS Header

Magic number:

Bytes on last page of file:

0x0090

Pages in file:

0x0003

Relocations:

0x0000

Size of header:

0x0004

Min extra paragraphs:

0x0000

Max extra paragraphs:

0xFFFF

Initial SS value:

0x0000

Initial SP value:

0x00B8

Checksum:

0x0000

Initial IP value:

0x0000

Initial CS value:

0x0000

Overlay number:

0x0000

OEM identifier:

0x0000

OEM information:

0x0000

Address of NE header:

0x00000118

PE Headers

Signature:

Machine:

IMAGE_FILE_MACHINE_I386

Number of sections:

Time date stamp:

10-Jul-2019 09:34:43

Pointer to Symbol Table:

0x00000000

Number of symbols:

Size of Optional Header:

0x00E0

Characteristics

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_RELOCS_STRIPPED

Sections

Name	Virtual Address	Virtual Size	Raw Size	Charateristics	Entropy
.text	0x00001000	0x00426000	0x00000000	IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE	0
.mapo	0x00681000	0x00022000	0x000216D0	IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE	6.36525
.rsrc	0x0067B000	0x00006000	0x00006000	IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE	4.81575
.mapo2	0x006A3000	0x0064F000	0x0064ECEA	IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE	7.94412

Resources

127

150

286

554

1031

1032

1033

1037

1038

1039

1084

1124

1134

1138

1139

1140

1141

1142

1143

1144

1145

1150

1151

1152

3841

3842

3843

3857

3858

3859

3865

3866

3867

3868

3869

26567

30721

30722

30977

30994

30995

30996

IEXT_IDB_STATEIMAGES

DEFAULT_ICON

Imports

kernel32.dll

RASAPI32.dll

USER32.dll

GDI32.dll

WINMM.dll

WINSPOOL.DRV

ADVAPI32.dll

SHELL32.dll

ole32.dll

OLEAUT32.dll

COMCTL32.dll

WS2_32.dll

WININET.dll

comdlg32.dll

Secur32.dll

urlmon.dll

SHLWAPI.dll

IPHLPAPI.DLL

Exports

No exports.

Screenshots

Screenshot of dab5146f6c7ebe3d04c4d903922c7202ce1af89f126386e317c7de88c8532c92 taken from 17392 ms from task started

Screenshot of dab5146f6c7ebe3d04c4d903922c7202ce1af89f126386e317c7de88c8532c92 taken from 25442 ms from task started

Screenshot of dab5146f6c7ebe3d04c4d903922c7202ce1af89f126386e317c7de88c8532c92 taken from 26454 ms from task started

Screenshot of dab5146f6c7ebe3d04c4d903922c7202ce1af89f126386e317c7de88c8532c92 taken from 27455 ms from task started

Screenshot of dab5146f6c7ebe3d04c4d903922c7202ce1af89f126386e317c7de88c8532c92 taken from 28465 ms from task started

Screenshot of dab5146f6c7ebe3d04c4d903922c7202ce1af89f126386e317c7de88c8532c92 taken from 29465 ms from task started

Screenshot of dab5146f6c7ebe3d04c4d903922c7202ce1af89f126386e317c7de88c8532c92 taken from 43600 ms from task started

Screenshot of dab5146f6c7ebe3d04c4d903922c7202ce1af89f126386e317c7de88c8532c92 taken from 45602 ms from task started

Screenshot of dab5146f6c7ebe3d04c4d903922c7202ce1af89f126386e317c7de88c8532c92 taken from 50644 ms from task started

Screenshot of dab5146f6c7ebe3d04c4d903922c7202ce1af89f126386e317c7de88c8532c92 taken from 52672 ms from task started

Screenshot of dab5146f6c7ebe3d04c4d903922c7202ce1af89f126386e317c7de88c8532c92 taken from 55690 ms from task started

Screenshot of dab5146f6c7ebe3d04c4d903922c7202ce1af89f126386e317c7de88c8532c92 taken from 71771 ms from task started

Screenshot of dab5146f6c7ebe3d04c4d903922c7202ce1af89f126386e317c7de88c8532c92 taken from 72780 ms from task started

Screenshot of dab5146f6c7ebe3d04c4d903922c7202ce1af89f126386e317c7de88c8532c92 taken from 74781 ms from task started

Processes

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

–

Specs description

Program did not start

Integrity level elevation

Task сontains an error or was rebooted

Process has crashed

Task contains several apps running

Executable file was dropped

Debug information is available

Process was injected

Network attacks were detected

Application downloaded the executable file

Actions similar to stealing personal data

Behavior similar to exploiting the vulnerability

Inspected object has sucpicious PE structure

File is detected by antivirus software

CPU overrun

RAM overrun

Process starts the services

Process was added to the startup

Behavior similar to spam

Low-level access to the HDD

Probably Tor was used

System was rebooted

Connects to the network

Known threat

Process information

Click at the process to see the details.

PID: 3596

CMD: "C:\Users\admin\AppData\Local\Temp\BOT.exe"

Path: C:\Users\admin\AppData\Local\Temp\BOT.exe

Indicators

Parent process: ––

User: admin

Integrity Level: MEDIUM

Version:

Company

Description

Version

Modules

Image
c:\users\admin\appdata\local\temp\bot.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rasman.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winmm.dll
c:\windows\system32\winspool.drv
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\secur32.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\pcwum.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\shunimpl.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\mpr.dll
c:\users\admin\appdata\local\temp\1476859\12376.dll
c:\windows\system32\msvcp60.dll
c:\windows\system32\version.dll
c:\windows\system32\cryptbase.dll
c:\progra~1\micros~1\office14\npauthz.dll
c:\program files\java\jre1.8.0_92\bin\dtplugin\npdeployjava1.dll
c:\progra~1\micros~1\office14\npspwrap.dll
c:\windows\system32\macromed\flash\npswf32_26_0_0_131.dll
c:\program files\google\update\1.3.34.11\npgoogleupdate3.dll
c:\program files\videolan\vlc\npvlc.dll
c:\program files\adobe\acrobat reader dc\reader\browser\nppdf32.dll
c:\program files\adobe\acrobat reader dc\reader\air\nppdf32.dll
c:\program files\java\jre1.8.0_92\bin\plugin2\npjp2.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\napinsp.dll
c:\windows\system32\pnrpnsp.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\winrnr.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\uxtheme.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\profapi.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\sensapi.dll

Registry activity

Total events

Read events

Write events

Delete events

Modification events

PID

Process

Operation

Key

Name

Value

3596

BOT.exe

write